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Abstract 

The Ekert quantum key distribution protocol [1] uses pairs of en¬ 
tangled qubits and performs checks based on a Bell inequality to detect 
eavesdropping. The N-DEB protocol [2] uses instead pairs of entan¬ 
gled qudits to achieve better noise resistance than the Ekert protocol. 
It performs checks based on a Bell inequality for qudits found in [3] 
and which we will refer to as the CGLMP-d. In this paper, we present 
the generalization of our protocol hSDEB [4] for qudits. This proto¬ 
col also uses pairs of entangled qudits, but achieves even better noise 
resistance than N-DEB and is showed to be secure against the same 
family of cloning attacks than N-DEB. This gain of performance is 
obtained by using another inequality called here hCHSH-d, which was 
discovered in [5]. For each party, the hCHSH-d inequality involves 2d 
observables. We explain how the parties can measure these observables 
and thus are able to check the violation of hCHSH-d. In the presence 
of noise, this violation allows the parties to ensure the secrecy of the 
key because it guarantees the absence of a local Trojan horse attack. 
The advantage of our proposed scheme is that it results in an increased 
resistance to noise while remaining secure against individual attacks. 
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1 Introduction 


The Ekert91 protocol [T] exploits pairs of entangled states to exchange keys, 
and uses Bell inequalities to detect eavesdropping. Some of the measurement 
results obtained by the two parties Alice and Bob are perfectly correlated, 
providing key bits. Other measurement results must exhibit quantum be¬ 
haviour if there is no alteration of the quantum channel, and this permits 
to detect eavesdropping by testing a Bell inequality violation. 

The amount of quantum violation is an important characteristic in key 
distribution protocols because a larger violation is one of the factors that 
lead to a better noise resistance [6]. Some progress has been made to increase 
this amount of violation with the use of parties with higher dimension [7] 
or specific entangled states. One can also consider choosing different Bell 
inequalities to detect eavesdropping. 

In their article introducing the N-DEB protocol [2], Durt, Kaszlikowski, 
Chen and Kwek use d-dimensional quantum systems (qudits), and the CGLMP- 
d inequality to obtain better noise resistance than for the Ekert’91 protocol. 

Our work makes one step further by using a recent discovered Bell inequal¬ 
ity (here called hCHSH-d), which belongs to the family of homogeneous Bell 
inequalities introduced in [5j . The amount of violation which can be achieved 
with entangled states is even better than for the CGLMP-d. Gonsequently, 
the protocol we derive is more tolerant to noise than N-DEB. 

Devices called multiport beam splitters [8] (or ditters), are mentioned in [2] 
as one way to handle measurements of qudits. Ditters are analyzed in [9] 
and experimentally tested for d = 3,4 in |10] . Our new protocol hdDEB 
described in this article is analysed in view of the use of ditters to imple¬ 
ment measurements. A crucial point here will be that some products of 
observables, each implemented by a ditter coupled with a measurement in 
the computational basis, can also be implemented by another single ditter. 
This is needed for our protocol as the inequality hGHSH-d involves such 
products. 

The paper is organized as follows. It begins with some reminders and pre¬ 
cisions about measurements with ditters in Section 2, where we also consider 
the use of ditters for implementing the product of observables. Then Sec¬ 
tion 3 recalls the N-DEB protocol. After that. Section 4 introduces the Bell 
inequality hGHSH-d we use and defines our new protocol hdDEB. In Sec¬ 
tion 5, we study the security of our protocol against individual attacks and 
we show that our protocol hdDEB reaches a compromise between resistance 
to noise and security. Finally, the paper concludes about the advantage of 
hdDEB providing better resistance to noise. 
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2 Prerequisites 


In what follows, all the sums will be taken modulo d. Our protocol use qudits 
and observables with d outcomes which we label for readability 1, co, 

. v 2’i7r 

where uj is the dr root of unity uj = e~. The observables used by the two 
parties Alice and Bob will be denoted respectively by A* and Bj for some 
indexes i and j. We will also use the correlation functions introduced in [TO] ; 

E{AiBj) = P{Ai = a,Bj = b) ab. 

2.1 Measurements with ditters 

A ditter is parameterized by a d-uplet ((/JQ) •••! ^d-i) of phase shifts. For 

readability we put 9j = exp(i(/9j) (for j = 0,1, d—1) and 0 = (0O) •••; 

The ditter performs over a qudit the following unitary transformation : 

d-l 

Ue-.= HDe = —Y,^^'0i\k) {l\ 
k,l=0 

where the matrices H and Dq are H = {uj^^)o<k,i<d-i and Dq = diag(0O) 9d-i)- 
After the transformation performed by the ditter, a measurement in the 
computational basis is made using d detectors. This measurement is repre¬ 
sented by the observable 


Z = {k\. 

k=0 

As we assumed the d possible outcomes to be labeled by complex roots of 
unity, we use unitary observables. Thus, the measurement obtained by the 
combination of the ditter and the detectors corresponds to the following 
observable 


d-l 

Ze := De*H^ZHDe = \k + l) {k\ (1) 

k=0 

which gives us, in the particular case where 6j = 6^: 

d-2 

Ze = 0'^"^|O)((i-l|+^r|fc + l)(A:|. (2) 

k=0 
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2.2 Products of incompatible observables 

Suppose that we have two measurement devices (each one represented by a 
ditter and a measurement in the computational basis), which implement the 
observables Zq and Z\ described by Equation ([ID, with 0 = {6q, 6i,6d-i) 
and A = (Aq, Ai, A^-i). Then we need to implement the product observ¬ 
able Z^Zj^ for i = 1, d — 2 and j = d — i — 1. 

Proposition 1. Let define the d-uplet of phase shifts T = ( 70 , 71 , ..., 7 d_i). 
For any i = 1,d — 2 and j = d — i — 1, the observable Z^Zj^ verifies : 

d-l 

Z^eZi = zl = Y,lk+ill\k) {k + l\ 

k=0 

with 

VA; 0,..., d 1 7fc i— 

Proof. From Equation ([ID, we write : 


d—1 d—1 

= (^ \k + i) (A;|) X (J] AA;+, \l + j) (^1) 

k=0 1=0 

d-l 

= ^ ^i+j^t+i+j^i^l+j \l + i + j) {l\ 

1=0 

d-l 

= J2Gk-ieiXk+iXU\k) {k + i\. 

k=0 

The generalized Pauli matrix Z in dimension d verihes Z'^ = Id- The 
matrix Z being unitary, it also verihes Id = ZZl, which gives Z'^~^ = Zb 
For any observable Zfi we have Z^^ = Z^H In order to 

rewrite a product observable as a new ditter measurement of the form Zp = 

Y.k=l'yk+i'yl\k) {k+ l\, we need 'Jk+ul = 9k-i9lXk+iXl_^. One of the 
possible solutions is : 

V/c 0, ..., d 1 7fc i— 

□ 

From Proposition 1, we conclude that any product observable Ze^A is 
implementable by a ditter and a detector, with the detector performing a 
measurement corresponding to the observable Zl instead of Z. 

3 The N-DEB protocol 

We will recall the N-DEB protocol introduced in [2]. 
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3.1 The d-dimensional inequality used in N-DEB 

For a given value of d, the N-DEB protocol uses the d-dimensional inequality 
introduced in [3] which is referred in N-DEB as the generalized CHSH and 
which we will call in our paper the CGLMP-d inequality. The maximally 
entangled state 





(3) 


j=0 


is known to violate this inequality with the four bases used in N-DEB. For 
these bases, we will use the same denomination ’’optimal bases” as in [2]. 
The violation values for d = 3,4,5 are summarized in the following table : 


d 

Vd 

Nd 

3 

1.436 

0.304 

4 

1.448 

0.309 

5 

1.455 

0.313 


Table 1: Violation value of the 
CGLMP-d inequality with the maxi¬ 
mally entangled state for d = 3,4,5 


3.2 The N-DEB procedure 

Alice uses four observables Aa with a = 0 to 3, corresponding to ditter mea¬ 
surements with phase shift (1, ..., Bob use four observables 

Bf, with 6 = 0 to 3, corresponding to ditter measurements with phase shift 

The following steps are repeated until Alice and 
Bob obtained a shared key of desired length. 

1. Alice and Bob obtain an entangled pair of states in the maximally 
entangled state defined in (j3|). 

2. Alice draws randomly a value for a G {0,1, 2, 3} and makes the mea¬ 
surement corresponding to the observable Aa whereas Bob draws ran¬ 
domly a value for b G {0,1,2,3} and makes the measurement corre¬ 
sponding to the observable Bh. 

3. When a = b, the results obtained by Alice and Bob are perfectly cor¬ 
related. Indeed, the two ditters used by Alice and Bob perform on the 
shared maximally entangled state the transformation {H (8) H){Dq (8 Dq*) 
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with 0 = (1, But it is easy to check that: 

d-l d-l 

j=0 k,k'=0 

k+k'=0[d\ 

Consequently, in this case where a = b, Alice and Bob obtain a new 
dit for the shared key. 

4. When a ^ b, Alice and Bob can use a fraction of their joint measure¬ 
ments to detect eavesdropping by checking a configuration of maximal 
violation of the CGLMP-d. 


4 The hdDEB protocol 

We will now describe our protocol. It achieves better noise resistance because 
it uses an homogeneous Bell inequality, which has a larger violation factor 
than CGLMP-d. 


4.1 Violation of the inequality hCHSH-rf 

Depending on the entangled state that we want to use in our protocol, we can 
choose an inequality belonging to the set of homogeneous Bell inequalities 
described in [S] and which will be called hCHSH-d. It has also been shown 
in [5] that the homogeneous Bell inequalities are satisfied under the hypoth¬ 
esis of local realism, and that they form a complete set. An homogeneous 
Bell inequality for two parties can in general be written 


Re( 


(Pcos{^ 


-E{T)) ^ 1 


(5) 


where p = e~d and T is an homogeneous polynomial in some measurements 
Alice and Bob can make. We call T a Bell operator. 

A feature of the homogeneous Bell inequalities is that T involve some prod¬ 
ucts of observables (for example A 1 A 2 , and A 1 A 2 for Alice in the case 

d = 5) which become incompatible when considered as quantum observables. 
The outcomes of such a product of course cannot be meant to be the prod¬ 
ucts of outcomes of incompatible observables. In Proposition 1, we show 
that if we use the unitary observables Zq defined in ([1]) for the Aj previ¬ 
ously described, the product is also a unitary observable which outcomes 
can be obtained with a single measurement. We also conclude that we can 
perform this product measurement in terms of a new ditter operation and 
a hnal detection in the computational basis. 
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The local realistic elements Af A\A 2 * = 1,d—2 and j 
and Alice have to be replaced by the observables 






- '■lA 


4 , 


d—i —1) 


where the zt is a product observable as described in Proposition 1 and 
©A, are the parameters corresponding to the optimal bases. Similarly, 
the party Bob has to use the observables , zl..^, z\^. 

After substituting these observables to the variables in a Bell operator T, a 
quantum state \'4>) violates the homogeneous Bell inequality associated to T 
with a violation factor u ^ 1 if it verifies (compare to (j^) : 


1 

d2cos(f) 


Re((V>|pT|V^)) = V 


for /? = e d . 


( 6 ) 


4.2 The hdDEB procedure 

As for the NDEB protocol described in [2], we denote = Aq~^~°'A‘1 with 
a = 0,1, 2,d—1 the observable parameterized by phase shift (1, 
and with 6 = 0,1, 2,d — 1 the observable parameterized 

by (1, Each of these observables is expected to be imple¬ 

mented with a single ditter from Proposition 1. 

1. Alice and Bob obtain an entangled pair of states in the d-dimensional 

d-l 

entangled state |V’) := X] \ jj) with 5j G C for some j = 0,d — 1. 

j=0 

2. Alice draws randomly a value of a and performs her measurement in 
the basis associated to the observable £/a whereas Bob draws randomly 
a value of ^b and performs his measurement in the basis associated 
to Bb- 

3. When a = b, the results obtained by Alice and Bob are perfectly corre¬ 
lated and they obtain a new dit for the shared key. Eor completeness, 
a proof of this statement is given in Appendix A. 

4. Eor some choices of a and b Alice and Bob collect the issues of their 
measurements in order to detect eavesdropping by checking a violation 
of the homogeneous Bell inequality hCHSH-d considered. 

4.3 Choice of the inequality and resistance to noise for d = 3, 4, 5 

With the four ’’optimal bases” described in [2], the maximally entangled 
states don’t allow to reach the largest violations. We consider several non- 
maximally entangled states which, when used with their corresponding ho¬ 
mogeneous Bell inequalities, reach largest violations. A precise derivation 
of the case 4 = 3 can be found in [1] . 
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We compare the violations for the following states jV’d) with d = 3,4,5 : 


|V’3) = ^(|00) + |11) + |22)). 
IV'4) = ^(|00) + |11) + |22) + |33)). 


iV's) = ^(|00) + 111) + |22) + |33) - i |44)). 

We use the homogeneous inequalities associated to each : 


with 


1 

d2cos(f) 


Re{pE{Td)) ^ 1 


(7) 


Ts = - [(a; - 4:){AlBj) + (cu + 2 ){AIBiB 2 ) + {uj - 1)(^?S|) 

+ (cj + 5){AiA2Bf) + (cj + 2)[AiA2BiB2) + (cu + 1 )(Aij 42-B2) 
+ (w + 5){AlB‘f) + (cj + 2){A2BiB2) + {oj — 1){A^B2)]^. 


Ti = -{3u + 1)(^?S3) - (cj + l){AlBfB2) - 5(a; - l){AlBiBl) 

- (3a; - 1)(A?5|) + (w + l){AlA2Bf) - {oj + 3)(^f^25fS2) 

- (a; + l){AlA 2 BiBl) - (3a; + l)(^fA 2 Sf) + (3a; + l){AiAlBl) 

+ (5a; + l)(AiA|i?2^2) — (7a; + I)(^iyl 2 -Bi-B 2 ) 4" 4“ 

- 5(a; + l)(yl27?^) + (a; — I)(j42i?3-B2) + (a; + I)(yl2-Bi7?2) 
-{oj-l)iAlBl). 

For conveniency, the Bell operator T 5 is derived in Appendix B. 

These states and the Bell operators corresponding to their inequalities were 
chosen because they reach the best compromise between noise resistance and 
security against individual attacks, as it will be explained in Section 5. 

We summarize each choice of entangled state and Bell operator in the 
following table : 



Td 

Vd 

Nd 

IV's) 

T 3 

1.505 

0.336 

IV' 4 ) 

Ta 

1.546 

0.353 

IV's) 

n 

1.574 

0.365 


Table 2: Violation value of the 
hCHSH-d inequality depending on the 
entangled state and its Bell operator 
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5 An alternative version of hdDEB secure against 
individual attacks 

5.1 An optimal cloning-based attack for the N-DEB and hd¬ 
DEB protocols 

A cloning-based attack uses a cloning machine (also known as doner) to copy 
an input state. Because of the no-cloning theorem, the clonage is imperfect 
and the adversary aims to design an optimal doner which copies a specific 
set of states as accurately as possible. Depending on the properties of the 
input state or the family of the doner, the state can be reproduced with a 
certain amount of fidelity Fa defined in m by 

Fa = (8) 

where "0 is the initial pure state, and p the density of the clone (not neces¬ 
sarily pure). 

In 12] is described a cloning-based attack which uses a phase-covariant qudit 
cloning machine. This doner acts with the same accuracy on each states of 
the optimal bases used in the N-DEB protocol. All these states are copied 
with the same fidelity Fa depending on the value of d : 


d 

3 

4 

5 

6 

7 

8 

9 

oo 

Fa 

0.7753 

0.7342 

0.7080 

0.6898 

0.6762 

0.6657 

0.6573 

0.5 


Proposition 2. The 2d bases considered in our protocol are copied with 
maximal fidelity when using the optimal phase-covariant doner described 
in 

Proof. Four of our bases are the same optimal bases than from [2]. The 
2{d — 2) remaining bases have vectors of the form : 

j=o 

But the doner described in [2] is optimal for all states of the form : 

E \jj) for all dj verifying |5^|2 = i. 
j=o 

Consequently, this doner is also the optimal asymmetric qudit doner when 
considering our 2d bases. □ 
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5.2 The violation of an homogeneous Bell inequality as a 
sufficient condition for security 

The violation factor is considered very important for the security of the 
key distribution protocol. The presence of noise is usually modeled by the 
replacement of the initial entangled state by a mixture 

iV^ + (1 - N) \^P) {^P\ (9) 

where N is the proportion of noise. The point is that the presence of noise 
decreases the experienced violation to (1 — N)v and that the protocol is 
considered useless when the initial state entanglement cannot be detected 
anymore. With this criterion, it has been shown that a protocol is resistant 
to the presence of noise up to a threshold : 


N = 1 — 1/v. 


( 10 ) 


When using a noisy channel described by ([9]), the hdelity (as defined in ([8|)) 
between the input state \'ip) and the output state is given by 


Fn 


d-l 

d 


A^ + 1 


where p' = + (1 ~ Ff) |'0) (^|. The presence of noise N does not erase the 

non-classicality of the correlations as long as it stays below the value given 
by (jlOll . Hence, it is possible to use a channel for secure key distribution if 
its hdelity satishes 


Fn > 


d-l 1 
dv d 


( 11 ) 


Suppose that an adversary Eve uses an optimal doner which copy an input 
state with hdelity Fa and introduces a minimal amount of error 1 — Fa 
indistinguishable from an unbiased noise. 

Eve’s attacks won’t be detected as long as Fa ^ Fn- Hence, the security 
of the protocol against individual cloning attacks is guaranteed if we have 
+ 3 > Fa- This is equivalent to u < - 
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By replacing Fa for each d = 3,4,5, we obtain the conditions : 


d 

Security criterion 

3 

V 

< 

1.508 

4 

V 

< 

1.549 

5 

V 

< 

1.575 

6 

V 

< 

1.593 

7 

V 

< 

1.607 

8 

V 

< 

1.618 

9 

V 

< 

1.627 

oo 


V 

< 2 


5.3 Comparison between N-DEB and hdDEB under the same 
security criterion 

By looking at Table 1 and Table 2, we notice that for each d = 3,4, 5 the 
violation values of CGLMP-d and hCHSH-d are below the security criterion, 
which ensure the security of the N-DEB and hNDEB protocols against this 
family of optimal cloning attacks. But it is also noticeable that, for each 
d = 3,4,5, there is a wide gap between the violation values attainable by 
CGLMP-d and the maximal value tolerated by the security threshold. This 
gap can be closed by the use of our inequality CGLMP-d which reaches 
largest violation values : 


d 

t’N-DEB 

■WhdDEB 

Security criterion 

3 

1.436 

1.505 

V < 1.508 

4 

1.448 

1.546 

V < 1.549 

5 

1.455 

1.574 

V < 1.575 


Moreover, this exploitable gap between un-deb and the security criterion 
increases with the dimension d. From this we conclude not only that our 
protocol tolerates a higher error rate in the channel than N-DEB while 
remaining secure against the same family of attacks, but also that this ame¬ 
lioration grows for a higher d. 

6 Conclusion 

Our goal was to generalize our protocol h3DEB [1| in any dimension d. By 
using the homogeneous Bell inequality hCHSH-d which reaches a better vi¬ 
olation factor than the CGLMP-d in dimension d = 3,4, 5, our new protocol 
hdDEB obtain a better threshold of noise resistance than N-DEB. 
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As the inequality hCHSH-d involves products of observables which become 
incompatible for quantum states, an important fact is the possibility to 
implement with slightly modified differs the single observable correspond¬ 
ing to these products. We showed in 4.2 that all the observables needed 
to compute the violation of an homogeneous Bell inequality, including these 
products of observables, can be implemented by replacing the final measure¬ 
ment with observable Z by a measurement with observable Zb Physically, 
this replacement corresponds just to a permutation of the detectors. 

The gain in noise resistance of our protocol over N-DEB is due to the use 
of the inequality hCHSH-d.This inequality detects violations of local realism 
when some measurements are multiplicatively related. By using differs mea¬ 
surements which respect this multiplicative constraints, the parties running 
the protocol are able to exploit its larger violation capabilities. 

The use of 2d bases instead of four has the drawback of decreasing the 
effective dit transfer rate (the probability to obtain a key dit decreases from 
j to and it makes our protocol more complex {2{d — 2) supplementary 
devices), which can be a potential source of added noise. In the other hand, 
our protocol tolerates a higher threshold of noise than the one in the N-DEB 
protocol. 

In the paper [2], the security of the protocol N-DEB against the optimal 
individual attack was investigated and it was possible to conclude that a 
violation of the CHSH-d inequality was a sufficient condition to guarantee 
the security against individual attacks. We study here the security of our 
protocol hdDEB against the same optimal individual attack and we conclude 
that our protocol is also secure against this cloning attack. 

For the same level of security against individual attacks, we consequently 
obtain a better noise resistance than N-DEB and this amelioration is more 
and more visible when d increases. 

Acknowledgement. One of the author (Z.A.) was partially supported by 
Thales Alenia Space during this work. 
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Appendix A 


We show that in the hdDEB procedure, when a = b, the results obtained by 
Alice and Bob are perfectly correlated. 


Let first define the d-dimensional entangled state \^l)) 
6j G C for some j = 0,..., d — 1. 


E b'i) with 

3=0 


The two ditters used by Alice and Bob perform on the state |?/>) the trans¬ 
formation {H ® H){Dq ® Dq*), with 0 = (1, ..., We use 

the notations : 


k,l=0 

where the matrices H and Dq are H = and Dq = diag(0O) di,..., 9d). 

We write : 
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{H (g) H){De 0 De*) = {HDq) 0 {HDq*) 

= i( E 1'=) ('I ® E ‘"‘'''"i' I*') (''!) 

“ k,l=Q k',l'=Q 

“ k,l,k',l'=0 

By applying this transformation to the state l"^), we obtain : 

d-l d-l d-l 

j=0 j=0 k,k'=0 

From 1 + w + + ... + = 0 we finally find : 


d-l 


d—1 d—1 


(HDe^ffne*)(Y^dUj}) = (Y^j)( E l^^'» 

j=0 j=0 k,k'=0 

k-\-k'=0ld] 


Appendix B 

In order to obtain the violation v ~ 1.574, we use the entangled state 

= ^(|00) + 111) + |22) + |33) - i |44)). 

with the following Bell operator : 

Ts = (2 u; 3 - 3a; + Q){A\Bf) - (4a;2 + 6 a; + ^){A\BIB 2 ) 

+ {7uj^ -uj^ + 2uj- 3){AfBfB^) + {uj^ + a;^ - 4a; - 3)(7lf.Bi.Bf) 

+ 2(a;3 + a;2 + ^uj){A\B^) - + 4a;2 + 3a; + 2){AlA2Bf) 

- (5a;3 + 3a;2 + 3a; + 4) (A?^ 2 ^ 1 - 82 ) - ( 20 ;^ + 30;^ + 2a; - 2) (Af^ 2 ^?) 
+ (— 2 a;^ + o;^ + l){A^A 2 BiB 2 ) + (4a;^ — 2 a; + 3)[A^A2B2) 

+ (—o;^ + 3a; + 3){AlA2Bf) + (2a;^ + 7a;^ + u!){A‘lA 2 BfB 2 ) 

- (4a;3 + 6a;2 + 5a; + 5)(^f7l|.Bf5|) - (3a;3 + 2)(7lf^|5i.B|) 

+ (5a;3 + a; + 4){AjAlB^) + (-2a;3 - 4a;2 + l)(yli^3^f) 

+ (o;^ + o;^ + a; + 2)[AiA2BfB2) + (o;^ + 3a; + l){AiA 2 BfB 2 ) 

- (7a;3 + 7a;2 + 4a; + 7)(^i7l|.Bi.B|) - (3a;^ + 2)(Ai7l|5|) 

+ (-2a;3 + 2uj^ + 3uj + 2)(A^Bf) - (30;^ + la;^ + 3a; + 3){A‘^BfB2) 

- (2a;3 + 3a; + 5){AjBfB^) - + 5uj^ + 2a; + 4)(^|.Bi.B|) 

- (4a;^ + 60 ;^ + 5a; + 5 )( 74 |i?|). 
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